Certificate trust

Which CAs the key server trusts, and enrolling leaf certificates.

Operation	Auth	Purpose
GET /api/trusted-cas	Bearer + DPoP	List the CA certificates this key server trusts.
POST /api/trusted-cas	Bearer + DPoP	Add ONE CA certificate to the trusted list.
POST /api/trusted-cas/remove	Bearer + DPoP	Remove a CA from the trusted list.
POST /api/certificates/enroll	Bearer + DPoP	Enrol leaf certificates, creating transport principals.